# F5 vulnerabilities > F5 has 895 published vulnerabilities across 290 products in our catalogue. 11 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Big-IP Access Policy Manager, with 544. If you run F5 software, patch the exploited flaws first. Canonical page: https://www.precursorintelligence.com/vendors/f5 ## At a glance - **Published vulnerabilities:** 895 - **Known to be exploited:** 11 - **Products:** 290 - **Versions:** 5,956 - **Most recently added to the known-exploited list:** [CVE-2023-46747](https://www.precursorintelligence.com/what-is/cve-2023-46747), 31 October 2023. We keep watching the list. ## Which F5 products have the most vulnerabilities? - [Big-IP Access Policy Manager](https://www.precursorintelligence.com/product/f5/big-ip_access_policy_manager): 544 published vulnerabilities, 276 versions - [Big-IP Application Security Manager](https://www.precursorintelligence.com/product/f5/big-ip_application_security_manager): 501 published vulnerabilities, 279 versions - [Big-IP Advanced Firewall Manager](https://www.precursorintelligence.com/product/f5/big-ip_advanced_firewall_manager): 475 published vulnerabilities, 259 versions - [Big-IP Local Traffic Manager](https://www.precursorintelligence.com/product/f5/big-ip_local_traffic_manager): 466 published vulnerabilities, 282 versions - [Big-IP Policy Enforcement Manager](https://www.precursorintelligence.com/product/f5/big-ip_policy_enforcement_manager): 457 published vulnerabilities, 256 versions - [Big-IP Link Controller](https://www.precursorintelligence.com/product/f5/big-ip_link_controller): 450 published vulnerabilities, 273 versions - [Big-IP Application Acceleration Manager](https://www.precursorintelligence.com/product/f5/big-ip_application_acceleration_manager): 448 published vulnerabilities, 253 versions - [Big-IP Analytics](https://www.precursorintelligence.com/product/f5/big-ip_analytics): 435 published vulnerabilities, 254 versions - [Big-IP Global Traffic Manager](https://www.precursorintelligence.com/product/f5/big-ip_global_traffic_manager): 415 published vulnerabilities, 265 versions - [Big-IP Domain Name System](https://www.precursorintelligence.com/product/f5/big-ip_domain_name_system): 392 published vulnerabilities, 255 versions Each product page lists its own known-exploited flaws. ## Which F5 vulnerabilities are being exploited? 11 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2023-46747](https://www.precursorintelligence.com/what-is/cve-2023-46747): F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 31 October 2023. - [CVE-2023-46748](https://www.precursorintelligence.com/what-is/cve-2023-46748): F5 BIG-IP Configuration Utility SQL Injection Vulnerability. High, CVSS 8.8, chance of use in 30 days 4.5%, known exploited since 31 October 2023. - [CVE-2023-44487](https://www.precursorintelligence.com/what-is/cve-2023-44487): HTTP/2 Rapid Reset Attack Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 10 October 2023. - [CVE-2014-0196](https://www.precursorintelligence.com/what-is/cve-2014-0196): Linux Kernel Race Condition Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 22%, known exploited since 12 May 2023. - [CVE-2022-1388](https://www.precursorintelligence.com/what-is/cve-2022-1388): F5 BIG-IP Missing Authentication Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 10 May 2022. - [CVE-2014-6271](https://www.precursorintelligence.com/what-is/cve-2014-6271): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022. - [CVE-2014-7169](https://www.precursorintelligence.com/what-is/cve-2014-7169): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022. - [CVE-2021-22991](https://www.precursorintelligence.com/what-is/cve-2021-22991): F5 BIG-IP Traffic Management Microkernel Buffer Overflow. Critical, CVSS 9.8, chance of use in 30 days 61%, known exploited since 18 January 2022. - [CVE-2021-40438](https://www.precursorintelligence.com/what-is/cve-2021-40438): Apache HTTP Server-Side Request Forgery (SSRF). Critical, CVSS 9.0, chance of use in 30 days >99%, known exploited since 1 December 2021. - [CVE-2020-5902](https://www.precursorintelligence.com/what-is/cve-2020-5902): F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. - [CVE-2021-22986](https://www.precursorintelligence.com/what-is/cve-2021-22986): F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. ## All F5 products we track 107 products with at least one tracked version, most vulnerabilities first: - [Big-IP Access Policy Manager](https://www.precursorintelligence.com/product/f5/big-ip_access_policy_manager): 544 vulnerabilities, 276 versions - [Big-IP Application Security Manager](https://www.precursorintelligence.com/product/f5/big-ip_application_security_manager): 501 vulnerabilities, 279 versions - [Big-IP Advanced Firewall Manager](https://www.precursorintelligence.com/product/f5/big-ip_advanced_firewall_manager): 475 vulnerabilities, 259 versions - [Big-IP Local Traffic Manager](https://www.precursorintelligence.com/product/f5/big-ip_local_traffic_manager): 466 vulnerabilities, 282 versions - [Big-IP Policy Enforcement Manager](https://www.precursorintelligence.com/product/f5/big-ip_policy_enforcement_manager): 457 vulnerabilities, 256 versions - [Big-IP Link Controller](https://www.precursorintelligence.com/product/f5/big-ip_link_controller): 450 vulnerabilities, 273 versions - [Big-IP Application Acceleration Manager](https://www.precursorintelligence.com/product/f5/big-ip_application_acceleration_manager): 448 vulnerabilities, 253 versions - [Big-IP Analytics](https://www.precursorintelligence.com/product/f5/big-ip_analytics): 435 vulnerabilities, 254 versions - [Big-IP Global Traffic Manager](https://www.precursorintelligence.com/product/f5/big-ip_global_traffic_manager): 415 vulnerabilities, 265 versions - [Big-IP Domain Name System](https://www.precursorintelligence.com/product/f5/big-ip_domain_name_system): 392 vulnerabilities, 255 versions - [Big-IP Fraud Protection Service](https://www.precursorintelligence.com/product/f5/big-ip_fraud_protection_service): 329 vulnerabilities, 249 versions - [Big-IP Webaccelerator](https://www.precursorintelligence.com/product/f5/big-ip_webaccelerator): 222 vulnerabilities, 185 versions - [Big-IP Edge Gateway](https://www.precursorintelligence.com/product/f5/big-ip_edge_gateway): 218 vulnerabilities, 172 versions - [Big-IP Advanced Web Application Firewall](https://www.precursorintelligence.com/product/f5/big-ip_advanced_web_application_firewall): 116 vulnerabilities, 119 versions - [Big-IP Websafe](https://www.precursorintelligence.com/product/f5/big-ip_websafe): 101 vulnerabilities, 87 versions - [Big-IP DDOS Hybrid Defender](https://www.precursorintelligence.com/product/f5/big-ip_ddos_hybrid_defender): 91 vulnerabilities, 110 versions - [Big-Iq Centralized Management](https://www.precursorintelligence.com/product/f5/big-iq_centralized_management): 76 vulnerabilities, 18 versions - [Big-IP SSL Orchestrator](https://www.precursorintelligence.com/product/f5/big-ip_ssl_orchestrator): 69 vulnerabilities, 84 versions - [Big-IP Protocol Security Module](https://www.precursorintelligence.com/product/f5/big-ip_protocol_security_module): 61 vulnerabilities, 39 versions - [Nginx](https://www.precursorintelligence.com/product/f5/nginx): 41 vulnerabilities, 556 versions - [Big-IP WAN Optimization Manager](https://www.precursorintelligence.com/product/f5/big-ip_wan_optimization_manager): 38 vulnerabilities, 16 versions - [Enterprise Manager](https://www.precursorintelligence.com/product/f5/enterprise_manager): 38 vulnerabilities, 8 versions - [Njs](https://www.precursorintelligence.com/product/f5/njs): 37 vulnerabilities, 60 versions - [Big-IP Carrier-Grade Nat](https://www.precursorintelligence.com/product/f5/big-ip_carrier-grade_nat): 35 vulnerabilities, 67 versions - [Big-IP Application Visibility and Reporting](https://www.precursorintelligence.com/product/f5/big-ip_application_visibility_and_reporting): 34 vulnerabilities, 61 versions - [Traffix Signaling Delivery Controller](https://www.precursorintelligence.com/product/f5/traffix_signaling_delivery_controller): 30 vulnerabilities, 11 versions - [SSL Orchestrator](https://www.precursorintelligence.com/product/f5/ssl_orchestrator): 27 vulnerabilities, 51 versions - [Big-Iq Device](https://www.precursorintelligence.com/product/f5/big-iq_device): 20 vulnerabilities, 4 versions - [Big-Iq Cloud](https://www.precursorintelligence.com/product/f5/big-iq_cloud): 20 vulnerabilities, 6 versions - [Big-Iq Security](https://www.precursorintelligence.com/product/f5/big-iq_security): 20 vulnerabilities, 6 versions - [Nginx Controller](https://www.precursorintelligence.com/product/f5/nginx_controller): 18 vulnerabilities, 31 versions - [Big-IP Access Policy Manager Client](https://www.precursorintelligence.com/product/f5/big-ip_access_policy_manager_client): 18 vulnerabilities, 12 versions - [Iworkflow](https://www.precursorintelligence.com/product/f5/iworkflow): 16 vulnerabilities, 6 versions - [Big-IP DNS](https://www.precursorintelligence.com/product/f5/big-ip_dns): 14 vulnerabilities, 13 versions - [Big-IP Next Service Proxy for Kubernetes](https://www.precursorintelligence.com/product/f5/big-ip_next_service_proxy_for_kubernetes): 13 vulnerabilities, 11 versions - [Big-Iq Cloud and Orchestration](https://www.precursorintelligence.com/product/f5/big-iq_cloud_and_orchestration): 12 vulnerabilities, 1 version - [F5os-a](https://www.precursorintelligence.com/product/f5/f5os-a): 11 vulnerabilities, 17 versions - [Big-IP Container Ingress Services](https://www.precursorintelligence.com/product/f5/big-ip_container_ingress_services): 11 vulnerabilities, 39 versions - [Nginx Plus](https://www.precursorintelligence.com/product/f5/nginx_plus): 11 vulnerabilities, 36 versions - [Big-IP Automation Toolchain](https://www.precursorintelligence.com/product/f5/big-ip_automation_toolchain): 11 vulnerabilities, 35 versions - [Big-IP Enterprise Manager](https://www.precursorintelligence.com/product/f5/big-ip_enterprise_manager): 10 vulnerabilities, 6 versions - [Firepass](https://www.precursorintelligence.com/product/f5/firepass): 10 vulnerabilities, 20 versions - [Big-IP Next Cloud-Native Network Functions](https://www.precursorintelligence.com/product/f5/big-ip_next_cloud-native_network_functions): 10 vulnerabilities, 9 versions - [Big-Iq Application Delivery Controller](https://www.precursorintelligence.com/product/f5/big-iq_application_delivery_controller): 9 vulnerabilities, 1 version - [F5os-C](https://www.precursorintelligence.com/product/f5/f5os-c): 9 vulnerabilities, 15 versions - [Nginx Open Source](https://www.precursorintelligence.com/product/f5/nginx_open_source): 8 vulnerabilities, 496 versions - [Arx](https://www.precursorintelligence.com/product/f5/arx): 8 vulnerabilities, 18 versions - [Big-Iq ADC](https://www.precursorintelligence.com/product/f5/big-iq_adc): 7 vulnerabilities, 1 version - [Tmos](https://www.precursorintelligence.com/product/f5/tmos): 7 vulnerabilities, 45 versions - [Nginx Ingress Controller](https://www.precursorintelligence.com/product/f5/nginx_ingress_controller): 7 vulnerabilities, 90 versions - [Big-IP Next Central Manager](https://www.precursorintelligence.com/product/f5/big-ip_next_central_manager): 7 vulnerabilities, 6 versions - [Firepass 4100](https://www.precursorintelligence.com/product/f5/firepass_4100): 7 vulnerabilities, 15 versions - [Big-IP Protocol Security Manager](https://www.precursorintelligence.com/product/f5/big-ip_protocol_security_manager): 7 vulnerabilities, 27 versions - [Big-IP Guided Configuration](https://www.precursorintelligence.com/product/f5/big-ip_guided_configuration): 6 vulnerabilities, 3 versions - [Nginx Instance Manager](https://www.precursorintelligence.com/product/f5/nginx_instance_manager): 6 vulnerabilities, 42 versions - [Access Policy Manager Clients](https://www.precursorintelligence.com/product/f5/access_policy_manager_clients): 5 vulnerabilities, 11 versions - [Arx Firmware](https://www.precursorintelligence.com/product/f5/arx_firmware): 4 vulnerabilities, 6 versions - [F5 Iworkflow](https://www.precursorintelligence.com/product/f5/f5_iworkflow): 4 vulnerabilities, 1 version - [Nginx API Connectivity Manager](https://www.precursorintelligence.com/product/f5/nginx_api_connectivity_manager): 3 vulnerabilities, 3 versions - [Big-IP](https://www.precursorintelligence.com/product/f5/big-ip): 3 vulnerabilities, 23 versions - [Websafe Alert Server](https://www.precursorintelligence.com/product/f5/websafe_alert_server): 3 vulnerabilities, 4 versions - [Big-IP Edge](https://www.precursorintelligence.com/product/f5/big-ip_edge): 3 vulnerabilities, 17 versions - [Big-IP Next for Kubernetes](https://www.precursorintelligence.com/product/f5/big-ip_next_for_kubernetes): 3 vulnerabilities, 2 versions - [Big-IP Service Proxy](https://www.precursorintelligence.com/product/f5/big-ip_service_proxy): 3 vulnerabilities, 19 versions - [Firepass SSL VPN](https://www.precursorintelligence.com/product/f5/firepass_ssl_vpn): 3 vulnerabilities, 9 versions - [Traffix Systems Signaling Delivery Controller](https://www.precursorintelligence.com/product/f5/traffix_systems_signaling_delivery_controller): 2 vulnerabilities, 10 versions - [Big-IP Afm](https://www.precursorintelligence.com/product/f5/big-ip_afm): 2 vulnerabilities, 1 version - [Big-IP Fraud Protection Services](https://www.precursorintelligence.com/product/f5/big-ip_fraud_protection_services): 2 vulnerabilities, 2 versions - [Big-IP Pem](https://www.precursorintelligence.com/product/f5/big-ip_pem): 2 vulnerabilities, 1 version - [Big-IP Next](https://www.precursorintelligence.com/product/f5/big-ip_next): 2 vulnerabilities, 1 version - [SSL Intercept Iapp](https://www.precursorintelligence.com/product/f5/ssl_intercept_iapp): 2 vulnerabilities, 2 versions - [Big-IP Ltm](https://www.precursorintelligence.com/product/f5/big-ip_ltm): 2 vulnerabilities, 1 version - [Nginx Agent](https://www.precursorintelligence.com/product/f5/nginx_agent): 2 vulnerabilities, 48 versions - [Big-IP Apm](https://www.precursorintelligence.com/product/f5/big-ip_apm): 2 vulnerabilities, 1 version - [Websafe](https://www.precursorintelligence.com/product/f5/websafe): 2 vulnerabilities, 3 versions - [Big-IP Controller](https://www.precursorintelligence.com/product/f5/big-ip_controller): 2 vulnerabilities, 15 versions - [Big-IP Asm](https://www.precursorintelligence.com/product/f5/big-ip_asm): 2 vulnerabilities, 1 version - [Nginx Security Monitoring](https://www.precursorintelligence.com/product/f5/nginx_security_monitoring): 2 vulnerabilities, 3 versions - [Big-IP Policy Webaccelerator](https://www.precursorintelligence.com/product/f5/big-ip_policy_webaccelerator): 1 vulnerability, 6 versions - [Big-IP Webaccelerator12.1.1](https://www.precursorintelligence.com/product/f5/big-ip_webaccelerator12.1.1): 1 vulnerability, 1 version - [Big-Iq](https://www.precursorintelligence.com/product/f5/big-iq): 1 vulnerability, 1 version - [Container Ingress Service](https://www.precursorintelligence.com/product/f5/container_ingress_service): 1 vulnerability, 1 version - [F5os](https://www.precursorintelligence.com/product/f5/f5os): 1 vulnerability, 12 versions - [Firepass 1000](https://www.precursorintelligence.com/product/f5/firepass_1000): 1 vulnerability, 1 version - [Firepass 1200](https://www.precursorintelligence.com/product/f5/firepass_1200): 1 vulnerability, 1 version - [Icontrol Service Manager](https://www.precursorintelligence.com/product/f5/icontrol_service_manager): 1 vulnerability, 4 versions - [Linerate](https://www.precursorintelligence.com/product/f5/linerate): 1 vulnerability, 22 versions - [Mobilesafe](https://www.precursorintelligence.com/product/f5/mobilesafe): 1 vulnerability, 1 version - [Nginx Controller API Management](https://www.precursorintelligence.com/product/f5/nginx_controller_api_management): 1 vulnerability, 3 versions - [Nginx Modsecurity WAF](https://www.precursorintelligence.com/product/f5/nginx_modsecurity_waf): 1 vulnerability, 2 versions - [Nginx Openid Connect](https://www.precursorintelligence.com/product/f5/nginx_openid_connect): 1 vulnerability, 1 version - [Nginx Service Mesh](https://www.precursorintelligence.com/product/f5/nginx_service_mesh): 1 vulnerability, 14 versions - [Application Security Manager Appliance](https://www.precursorintelligence.com/product/f5/application_security_manager_appliance): 1 vulnerability, 2 versions - [Arx Data Manager](https://www.precursorintelligence.com/product/f5/arx_data_manager): 1 vulnerability, 2 versions - [Big-IP 2000](https://www.precursorintelligence.com/product/f5/big-ip_2000): 1 vulnerability, 1 version - [Big-IP 4000](https://www.precursorintelligence.com/product/f5/big-ip_4000): 1 vulnerability, 1 version - [Big-IP Configuration Utility](https://www.precursorintelligence.com/product/f5/big-ip_configuration_utility): 1 vulnerability, 4 versions - [Big-IP I2000](https://www.precursorintelligence.com/product/f5/big-ip_i2000): 1 vulnerability, 1 version - [Big-IP I4000](https://www.precursorintelligence.com/product/f5/big-ip_i4000): 1 vulnerability, 1 version - [Nginx Unit](https://www.precursorintelligence.com/product/f5/nginx_unit): 0 vulnerabilities, 48 versions - [Nginx Gateway Fabric](https://www.precursorintelligence.com/product/f5/nginx_gateway_fabric): 0 vulnerabilities, 4 versions - [F5 Access](https://www.precursorintelligence.com/product/f5/f5_access): 0 vulnerabilities, 10 versions - [Traffix Sdc](https://www.precursorintelligence.com/product/f5/traffix_sdc): 0 vulnerabilities, 11 versions - [DDOS Hybrid Defender](https://www.precursorintelligence.com/product/f5/ddos_hybrid_defender): 0 vulnerabilities, 11 versions - [VPN Client for Windows](https://www.precursorintelligence.com/product/f5/vpn_client_for_windows): 0 vulnerabilities, 2 versions - [Big-IP Edge Fraud Protection Service](https://www.precursorintelligence.com/product/f5/big-ip_edge_fraud_protection_service): 0 vulnerabilities, 3 versions - [Big-IP Aam](https://www.precursorintelligence.com/product/f5/big-ip_aam): 0 vulnerabilities, 45 versions ## Questions ### How many vulnerabilities does F5 have? Our catalogue lists 895 published vulnerabilities across 290 products and 5,956 versions from F5. The most recent F5 flaw added to the known-exploited list is CVE-2023-46747, on 31 October 2023. ### Which F5 vulnerabilities are being exploited? 11 F5 vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2023-46747, CVE-2023-46748 and CVE-2023-44487. The full list is on this page. ### Which F5 product has the most vulnerabilities? Big-IP Access Policy Manager, with 544 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new F5 vulnerabilities? Create a Precursor Intelligence account and track the F5 products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running F5? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact